SB2026102270 - Incorrect comparison in Linux kernel core en_accel driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect comparison (CVE-ID: CVE-2026-98497)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to interfere with IPv6 IPsec policy enforcement, potentially causing traffic to be incorrectly included in or excluded from a policy.

The vulnerability exists due to incorrect address matching in the Linux kernel mlx5e driver's setup_fte_addr6() function when installing IPv6 IPsec policies with different source and destination prefix lengths. A remote attacker can send IPv6 traffic to trigger incorrect policy matching because the hardware rule applies the destination prefix mask to the source address and the source prefix mask to the destination address.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/10de7ed8ef4840da9ca21de4c29578657ac367db
• https://git.kernel.org/stable/c/3803dc8477f08e0dac4050cafee0de43f32727be
• https://git.kernel.org/stable/c/e73f832f0a7b2c6ea45b2124c732d639be97b547